2

How can I re-enable TLS 1.1 and 1.0 on server 5.3 with macOS 10.12.4 in the short term while I evaluate all the clients that aren't ready for TLS 1.2?

If you jump to the bottom, attempts to change comfiguration files have failed so far to restore backwards compatibility

SSLProtocol -all +TLSv1 +TLSv1.1 +TLSv1.2

After having updated our server to macOS 12.4 and the Server app to version 5.3, using curl to connect to a macOS server https site from a Linux machine ceased to work, issuing the following messages on the client side:

$ curl -v --insecure -o "output.file" https://myserver.domain/path/page.php
* About to connect() to myserver.domain port 443 (#0)
*   Trying 192.168.xxx.xxx... connected
* Connected to myserver.domain (192.168.xxx.xxx) port 443 (#0)
* successfully set certificate verify locations:
*   CAfile: none
  CApath: /etc/ssl/certs/
* SSLv3, TLS handshake, Client hello (1):
} [data not shown]
* error:1407742E:SSL routines:SSL23_GET_SERVER_HELLO:tlsv1 alert protocol version
* Closing connection #0

The connection worked well before the update of the macOS server. So it seems that the update switched off a connection option which curl relies on. I googled a lot, but I am still uncertain about what exactly the cause is.

The same curlcommand works when issued from another Mac. The linux machine has

$ curl --version
curl 7.19.0 (x86_64-suse-linux-gnu) libcurl/7.19.0 OpenSSL/0.9.8h zlib/1.2.3 libidn/1.10
Protocols: tftp ftp telnet dict ldap http file https ftps 
Features: GSS-Negotiate IDN IPv6 Largefile NTLM SSL libz 

while on the Mac client

$ curl --version
curl 7.51.0 (x86_64-apple-darwin16.0) libcurl/7.51.0 SecureTransport zlib/1.2.8
Protocols: dict file ftp ftps gopher http https imap imaps ldap ldaps pop3 pop3s rtsp smb smbs smtp smtps telnet tftp 
Features: AsynchDNS IPv6 Largefile GSS-API Kerberos SPNEGO NTLM NTLM_WB SSL libz UnixSockets 

Unfortunately, it is not an option to try updating curlon the Linux machine.

Some resources claim incompatible cipher suites to be the cause, but after some testing, I haven't been able to find a solution using the --ciphers option, and also I am not sure how to find a compatible cipher suite.

I have tried to find out what changed with macOS Server 5.3, but the Apple change log does not give me any hint about it. So the question is:

What has changed in macOS 12.4 and/or macOS Server 5.3 and how can I re-configure my macOS server so the curlconnection works again?

Update 1:

I have temporarily exposed port 443 to the public, so I could perform the SSL Labs tests. The results show that my macOS server supports only TLS 1.2 and nothing else any more. For several simulated clients, the test report Server sent fatal alert: protocol_version - including, for example, IE8-10/Win7 and Java7u25.

I have tried to reactivate TLS 1 and 1.1 in

  • /library/server/web/config/apache2/sites/0000_127.0.0.1_34543_myserver.domain.conf
  • /library/server/web/config/apache2/httpd.conf
  • /library/server/web/config/apache2/httpd_server_app.conf
  • /library/server/web/config/proxy/apache_serviceproxy.conf (multiple instances here)

changing

SSLProtocol -all +TLSv1.2

into

SSLProtocol -all +TLSv1 +TLSv1.1 +TLSv1.2

or even

SSLProtocol All

but it did not make a difference when fetching the URL with curl.

Update 2:

The service proxy error log shows

[datetime] [ssl:info] [pid n] [client x.x.x.x:38805] AH02008: SSL library error 1 in handshake (server myserver.domain:443)
[datetime] [ssl:info] [pid n] SSL Library Error: error:1408A10B:SSL routines:SSL3_GET_CLIENT_HELLO:wrong version number
[datetime] [ssl:info] [pid n] [client x.x.x.x:38805] AH01998: Connection closed to child 11 with abortive shutdown (server myserver.domain:443)

To me, it looks as if my attempts to activate TLS v1 do not work.

So the question is: How can I reactivate TLS v1 in macOS Server Apache?

3

curl 7.19.0 ... OpenSSL/0.9.8h

This is a very old (and unsupported) version of OpenSSL you are using here which has no support for modern protocols like TLS 1.2 and modern ECDHE ciphers. Chances are high that after the upgrade your server now requires such protocol and/or cipher and thus connecting with your old OpenSSL version will fail.

* SSLv3, TLS handshake, Client hello (1):

This might also indicate that your client is trying to use SSL 3.0, which is usually disabled today because it is an insecure protocol. You might try to enforce to use TLS 1.0 (which is supported by OpenSSL 0.9.8) by using curl -1 or curl --tls1 in the hope that the server still supports TLS 1.0 and has ciphers configured to be usable by the old OpenSSL version.

  • curl 7.19 might be old, but it still connects fine with any other https web site I've tried (google.com etc.). According to httpd config files, the macOS server support TLS 1, 1.1, and 1.2, but using -1 with curl would not help. curl trace output seems not to be very helpful. Do you have any other idea how to track down the cause of the connection problems? – not2savvy Apr 9 '17 at 14:38
  • @not2savvy: looking at log messages on the server might help since the server is the one sending the TLS alert because it does not like something the client has sent. If your server is public you might also check it server against SSLLabs which also shows behavior with specific clients or libraries. – Steffen Ullrich Apr 9 '17 at 14:47
  • There are no messages in the apache log. The server isn't public. I tried openssl s_client -connect myserver.domain:443 from my Mac, but it results in CONNECTED(00000003) 16140:error:140790E5:SSL routines:SSL23_WRITE:ssl handshake failure:/BuildRoot/Library/Caches/com.apple.xbs/Sources/OpenSSL098/OpenSSL098-64.50.6/src/ssl/s23_lib.c:185:. And if I add -tls1, then I get 31629:error:1409442E:SSL routines:SSL3_READ_BYTES:tlsv1 alert protocol version:s3_pkt.c:1053:SSL alert number 70 in addition to above messages. – not2savvy Apr 9 '17 at 16:01
  • I've managed to run the SSLLabs tests on our server. I have updated my question with the results. – not2savvy Apr 9 '17 at 16:43
  • @not2savvy: so my assumption with the TLS version was correct. Did you restart the server after you've made the configuration change to allow TLS 1.0? And did you recheck with SSLLabs because maybe now TLS 1.0 is no longer the problem but the ciphers. – Steffen Ullrich Apr 9 '17 at 17:02
1

In order to re-enable TLSv1 (or other protocols), it is required to modify the proxy configuration in /Library/Server/Web/config/proxy/apache_serviceproxy.conf, adding the required protocol to the <VirtualHost *:443> section like so:

<VirtualHost *:443>
  ProxyPreserveHost On
 SetEnv proxy-chain-auth on
 RequestHeader set X-Forwarded-Proto "https"
 RequestHeader set X-Forwarded-Port "443"
 RequestHeader unset Proxy early
 <IfModule mod_ssl.c>
   SSLEngine On
   SSLCertificateFile "/etc/certificates/${CERT_ID}.cert.pem"
   SSLCertificateKeyFile "/etc/certificates/${CERT_ID}.key.pem"
   SSLCertificateChainFile "/etc/certificates/${CERT_ID}.chain.pem"
   SSLCipherSuite "HIGH:MEDIUM:!MD5:!RC4:!3DES"
   SSLProtocol -all +TLSv1 +TLSv1.1 +TLSv1.2
   SSLProxyEngine On
   SSLProxyProtocol -all +TLSv1.2
   SSLProxyCheckPeerCN off
   SSLProxyCheckPeerName off
 </IfModule>
 [...]
</VirtualHost>

According to my tests, SSLProxyProtocol need not be modified. Also, changes in the other files mentioned in the question do not have an effect, so they need not be touched.

Caveat: Upgrading your Server app will probably always overwrite /Library/Server/Web/config/proxy/apache_serviceproxy.conf. After an upgrade, you will have to reapply the modification.


Note: I have tried to move the changes to a separate custom configuration file apache_serviceproxy_customsites_myserver.domain.conf, which should stop Server upgrades from reverting these modifications. In addition to that, the protocol change could be limited to a specific domain. But that did not seem to work - still investigating why.


In order to make sure your modifications are used, it seems to be necessary to restart macOS (sudo shutdown -r), not only the webserver (sudo serveradmin stop/start web) in order to restart the proxy service.

A verification by the SSL Labs server test reports that TLS 1.0, 1.1 and 1.2 are now available, while SSL 2 and 3 are not.

-3

I also need to enable TLS 1.1 on Sienna Server 5.3 There are a few emails that aren't getting through due to it.

/library/server/web/config/apache2/sites/0000_127.0.0.1_34543_myserver.domain.conf

/library/server/web/config/apache2/httpd.conf
FILE NOT ON MY SERVER

/library/server/web/config/apache2/httpd_server_app.conf
editing (in bold) and restarting did nothing

IfModule mod_ssl.c
SSLProtocol -all +TLSv1.1 +TLSv1.2 --DIDNT WORK
SSLProtocol All --DIDNT WORK

/library/server/web/config/proxy/apache_serviceproxy.conf (multiple instances here)

sorry I'm not using this right, but hopefully when I am done it will be an actual answer

  • Yes, see my answer. The files I changed are listed in the question. But you shouldn't create an answer, if you are actually asking for more info. – not2savvy May 4 '17 at 15:21

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .